Lecture: SAT & SMT, Part 2

Date: 1/25/17

Reading

• Required reading: Satisfiability Modulo Theories: Introduction and Applications, Leonardo de Moura and Nikolaj Bjorner, CACM, 2011.
• Optional reading: Proofs in Satisfiability Modulo Theories, Clark Barrett, Leonardo de Moura, and Pascal Fontaine, Mathematical Logic and Foundations. College Publications, 2015.

No summaries are necessary for this class.

Class notes

• Administrative
  • Everyone signed up for a paper?
  • First assignment due this Friday. Turn in via Blackboard.
• SAT/SMT: Why start here?
  • Very successful
  • Can be used for lots of things, not just verification
  • Last class: saw one example of Z3 chewing through a verification problem
  • Today: SAT/SMT background and theory. Plus applications
  • Background: Decideable/Undecidable
• SAT
  • Definitions
    • determine whether a boolean function can be true
      • Show slides for propositional logic
    • interface: return an assignment if SAT, or UNSAT
      • Disjunctive Normal Form (DNF): (A and B) or (C and D)
        • SAT is easy. Why?
        • Why not use? Conversion blows up
      • Conjunctive Normal Form (CNF): (A or B) and (C or D)
        • SAT is hard (easy for 2-CNF, but NP-Hard for 3-CNF and up)
          • Usually want the assignment too!
        • But there’s a linear, SAT-preserving transformation
    • can be considered a well engineered search
  • History
    • truth table
    • binary decision tree
    • 1962: DPLL algorithm
    • 1971: SAT is NP-complete (The Complexity of Theorem-Proving Procedures, Stephen Cook)
    • 1986: Binary Decision Diagram (BDD) - Graph-Based Algorithms for Boolean Function Manipulation, Randal Bryant - Canonical ordering - Merge isomorphic subgraphs. Elminate nodes with isomorphic children. - Efficiently represent sets and relations - Variable ordering makes a big difference in size of BDD (but choice is NP-hard)!
    • Model checking
      • Ed Clarke: Model checking, symbolic model checking using BDDs (Ken McMillan), BMC via SAT, CounterExample-Guided-Abstraction-Refinement (CEGAR)
    • See the graph in the slides for progres
      • 2001: zChaff SAT solver
        • Watched literals: Quickly determine if a clause is satisfied and to efficiently backtrack
        • Lots of other clever optimizations
  • DPLL: See slides
    • Core algorithm from 1960s, but decades of improvements to every piece
  • CDCL

• SMT

• Applications
  • high-level workflow
    • encode systems problems into boolean functions
    • invoke the decision procedure

    • compared to Dafny: connection to programming language! Plus data structures, induction, etc.

    • ∃x: P(x). Decideable!
      • example: can a packet reach A from B
      • example: symbolic model checking (e.g., EXE/KLEE)
        • eliminating infeasible branches
        • finding input to trigger bugs
      • White box fuzz testing (e.g., SAGE)
    • variant ∀x: P(x)

      • check if ∃x: ¬P(x) is UNSAT. Decideable!

      • Exercise: verify x + x ⇒ x << 1 (see lsh.py)

      • example: would input never trigger a bug at a given program point

    • variant ∀x: P(x) = Q(x)
      • example: CheckFence [PLDI’07] - if a concurrent data structure behaves the same on SC and a relaxed memory model
      • example: Brumley et al. server fingerprint [USENIX Security’07] - if two web server implementations handle the protocol differently
      • example: STACK [SOSP’13] - if a program behaves the same under two different interpretations of the C standard
        • Best paper award
    • variant ∃y: x ≠ y ∧ P(x) = P(y) for a given x
      • example: privatebug [ASPLOS’08] - generate bug report with better privacy
    • find all { x | P(x) }
      • relations can be represented as boolean functions; Datalog
      • approaches: BDD, SAT solver + loop, etc.
      • example: program analysis & bddbddb (e.g., the set of memory locations each pointer can point to)
      • example: header space analysis (e.g., what are all the packets from A to B)
    • ∃c∀x: P(c, x)

      • 2QBF; synthesis

      • Example: See add2.py
        • synthesis exercise: x*4 == x + x
      • example: Ras Bodik: Sketching [PLDI’05, ASPLOS’06]
    • design trade-off
      • does your problem really need quantifiers?
      • is SMT expressive enough for your problem?

• Any questions about the paper?

• Next class preview:
  • We’ll look at Dafny, which uses Z3, and start verifying programs directly